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Abstract 

The  problem  of  signal  integrity  for  GPS  satellites  and  the  primary  dependency  upon 
inherent  characteristics  of  onboard  atomic  frequency  standards  are  discussed.  In  particular, 
there  is  a  need  for  characterizing  peak  deviation  of  GPS  clocks  from  prediction.  Results  from  a 
preliminary  study  of  two  GPS  clocks  tested  on  the  ground  show  that  the  distribution  of  peak 
deviations  from  prediction  cannot  be  assumed  to  be  Gaussian. 


SIGNAL  INTEGRITY  FOR  GPS 

Navigation  aids  used  in  aviation  and  other  safety  critical  applications  must  meet  extremely  stringent 
requirements  for  signal  integrity,  reliability,  availability,  and  accuracy.  One  of  the  difficulties  of  using 
GPS  for  such  applications  is  the  need  to  ensure  the  integrity  of  the  signals  received  by  the  user,  especially 
since  there  are  a  number  of  possible  failures  modes,  emanating  from  within  any  of  the  three  segments 
comprising  GPS  (Space,  Control,  and  User)  [1],  GPS  is  different  from  ground-based  navigation  aids, 
because  the  impact  of  satellites  out  of  service  is  not  easily  identified  and  made  known  to  the  diverse  users, 
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and  the  areas  of  degraded  coverage  are  not  stationary.  As  a  result,  the  current  GPS  by  itself  does  not 
provide  levels  of  integrity,  continuity,  and  time-to-alert  requirements  adequate  to  permit  primary  reliance 
for  safety-of-life  applications. 

To  meet  the  needs  of  signal  integrity  (Integrity  attributes  are  further  discussed  in  the  Appendix), 
augmentation  systems  such  as  the  Local  (LAAS)  and  Wide  Area  Augmentation  System  (WAAS)  are 
being  developed  and  deployed  to  address  some  of  the  shortcomings.  However,  there  are  inherent  aspects 
of  the  current  architecture  that  make  it  difficult  to  achieve  required  performance  levels,  as  embodied  in 
the  RTCA  advisory  standards  [2,3],  even  with  the  currently  planned  augmentations.  Note,  RTCA  used  to 
stand  for  Radio  Technical  Commission  on  Aeronautics.  However,  now  all  their  documents  are  marked 
RTCA  Inc.  The  efforts  to  address  limitations  of  the  current  GPS  and  the  associated  augmentation  systems 
have  resulted  in  increased  complexity.  Since  an  important  objective  for  future  generations  of  satellite- 
based  navigation  should  be  to  meet  and  exceed  the  service  guarantees  of  other  federally  provided  radio 
navigation  aids,  such  as  the  Instrument  Landing  System  (ILS),  VHF  Omni  Directional  Range  (VOR),  and 
Distance  Measuring  Equipment  (DME)  [4],  overcoming  the  limitations  of  ground-based  augmentation 
systems  could  be  a  primary  requirement  of  a  next  generation  GPS  system. 

The  difficulty  in  meeting  the  integrity  standards  in  general  stems  from  present  reliance  on  primarily 
ground-based  methods,  such  as  the  Wide  Area  Augmentation  System.  The  GPS  signals  are  monitored  at 
ground  stations  worldwide,  from  which  data  the  clock  and  ephemeris  solutions  are  generated  at  the 
Master  Control  Station  (MCS),  and  then  uploaded  to  each  Space  Vehicle  (SV)  of  the  constellation.  This 
information  forms  the  core  of  the  L-band  navigation  message.  If  there  are  anomalies  in  the  signal  due  to 
the  information  embedded  within  the  message  or  within  the  satellite  hardware,  these  can  only  be  detected 
after  the  signals  are  received  at  monitoring  locations,  then  evaluated  for  correctness  at  the  MCS  and  an 
alarm  message  sent  up  to  the  SV  for  alerting  the  users.  This  cycle  may  take  several  minutes  or  even 
hours,  depending  on  the  location  of  the  failed  satellite.  This  delay,  along  with  the  extended  reception 
path,  is  the  reason  for  the  complexity  of  ground-based  solutions  of  this  dilemma,  resulting  in  higher  costs 
and  the  difficulty  in  alerting  users  of  the  failure  quickly,  in  a  timely  manner. 

To  obviate  this  difficulty,  satellite-based  monitoring  schemes  have  been  proposed  to  cover  several 
possible  failure  modes,  including  excessive  clock  acceleration.  However,  the  problem  is  compounded  as 
signal  phase  deviations  are  generally  not  Gaussian  and,  therefore,  such  statistics  can  not  be  relied  upon  to 
meet  probability  requirements. 


PRELIMINARY  STUDY  OF  PEAK  DEVIATIONS  IN  ATOMIC 
CLOCKS 

Two  GPS  atomic  clocks,  using  data  from  life-tests  on  the  ground  at  the  Naval  Research  Lab  (NRL),  were 
studied.  The  peak  deviation  from  a  near-optimal  prediction  of  the  time  of  the  clocks  is  computed. 
Prediction  error  is  a  function  of  prediction  time  interval.  This  addresses  the  question:  What  levels  of 
integrity  can  GPS  clocks  support?  Clock  signals  from  GPS  are  corrected  by  predictions  that  are 
uploaded.  Between  uploads,  the  peak  deviation  from  the  prediction  is  the  worst-case  level  of  integrity 
that  the  clock  would  support.  Hence,  the  peak  deviation  from  prediction  gives  a  minimal  level  of 
integrity  that  a  clock  would  support. 

The  distribution  of  prediction  errors  is  computed  over  the  following  time  intervals:  15  minutes,  1  hour,  2 
hours,  4  hours,  8  hours,  1  day.  To  do  this,  we  first  near-optimally  estimated  the  fractional  frequency  of 
each  clock.  The  two  clocks  were  Block  HR  rubidium  clocks,  serial  numbers  R28  and  R30.  They  were 
chosen  as  one  of  the  worst,  R28,  and  the  best,  R30,  clocks  from  the  qualification  tests.  The  data  sets  were 
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20  s  phase  offsets  from  the  reference  H-Maser  over  MJDs  51666-  51816.  We  show  the  filtered  fractional 
frequency  on  top  of  the  fractional  frequency  estimates  from  1 st  differences  over  20  s  in  the  figures  below. 

We  estimated  the  linear  frequency  drift  for  each  clock  as  a  constant  over  the  data  interval.  This  was  done 
using  a  four-point  estimator,  as  outlined  in  [5]. 

For  R28,  in  Figure  1,  we  see  a  number  of  frequency  steps.  For  R30,  we  note  that  the  filtered  estimate 
does  not  go  through  the  mean  or  center  of  the  1 st  difference  fractional  frequency  data.  These  two  effects 
result  in  non-Gaussian  peak  deviation  errors,  for  different  reasons.  Frequency  steps  cause  peak  prediction 
error  in  time  data,  because  the  predictor  does  not  know  about  the  step  change  in  frequency.  Flence,  we 
find  that  the  longer  the  prediction  interval,  the  worse  the  error. 
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Figure  1.  Clock  R28  fractional  frequency  offset  from  1st  differences  of  20  s 
measurements  and  from  filter. 
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Figure  2.  Clock  R30  fractional  frequency  offset  from  1st  differences  of  20  s 
measurements  and  from  filter. 


We  compute  the  distribution  of  peak  prediction  errors  as  follows: 

1)  Pick  a  prediction  interval,  %  among:  15  minutes,  1  hour,  2  hours,  4  hours,  8  hours,  1  day. 

2)  For  each  20  s  measurement  at  time  t,  take  the  phase  offset  from  the  reference  at  that  time, 
x(t),  and  use  the  filtered  fractional  frequency  at  that  time,  y(t),  and  estimated  linear  frequency 
drift,  d,  to  predict  time  forward  as  a  quadratic  over  the  given  prediction  interval  from  1).  This 
is  the  predicted  time: 

P(t+r)=  x(t)+ y(t)*  r+  d*r 

3)  The  peak  deviation  error  at  t+  %  over  the  prediction  interval  r,  is  the  difference  between  the 
predicted  time  and  the  measured  time: 

PeakDev(t,  T)  =  Pft+T)  -  x(t+Z) 

4)  We  collect  the  PeakDev(t,  T)  for  all  of  the  possible  values  of  t  in  the  data  set.  Plotting  these 
as  a  histogram  gives  the  distribution  function. 

The  plots  below  show  how  prediction  error  arrived  for  different  prediction  intervals  for  R28. 
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Prediction  Error  at  Various  Intervals  (R28)  MJD  51666-51816 
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Figure  3.  Prediction  error  for  various  prediction  intervals,  showing  when  the  errors  occur. 


These  plots  lead  to  the  distribution  functions  for  R28  in  Figure  4.  The  dashed  lines  are  a  best-fit  Gaussian 
distribution  to  the  data. 
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Figure  4.  Prediction  error  for  various  prediction  intervals,  showing  the  distribution  of  errors.  The  dashed 
lines  show  best  fits  for  Gaussian  distributions. 
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For  R30,  we  found  a  different  effect,  than  for  R28.  R30  had  no  significant  frequency  steps  over  the  study 
interval.  However,  as  we  noted  above,  the  filtered  fractional  frequency  estimate  did  not  go  through  what 
appeared  to  be  the  center  of  the  fractional  frequency  from  1st  differences  of  measurements.  To  understand 
this,  we  looked  at  the  distribution  of  all  of  the  residuals  of  fractional  frequency  from  1st  differences  of 
measurements  differenced  from  the  filtered  estimates.  See  Figure  5  below. 


1500 


R30  Frequency  Residuals  @  20  s 


1000 


500  ■ 


Distribution 
—  —  •  Normal  Fit 


-1  0  1 
Prediction  Error,  ns/s 


x  10 


4 

-3 


Figure  5.  Fractional  frequency  residuals  for  clock  R30  showing  the  bimodal  behavior  of 
the  clock.  The  dashed  line  is  a  best  fit  for  a  Gaussian  distribution. 


The  high  peak  at  around  0  is  simply  because  of  data  gaps.  We  interpolated  ten  the  filter  and  measurement 
were  aligned.  However,  note  the  bimodal  nature  of  the  distribution.  The  clock  appears  to  have  two 
modes  separated  by  almost  3  x  10' 12  in  fractional  frequency.  This  results  in  the  distributions  of  time 
deviations  having  a  nonzero  mean.  See  Figure  6  below. 


CONCLUSIONS 

We  conclude  that  one  cannot  assume  that  Gaussian  statistics  are  valid  for  Peak  Deviation  of  atomic  clocks 
from  prediction.  Hence  we  cannot  look  at  a  Root-Mean-Squared  measure  of  clock  performance,  such  as 
the  Allan  variance,  and  use  that  to  predict  probabilities  of  peak  time  deviations.  To  determine  failure 
probabilities  for  integrity,  it  will  be  necessary  to  characterize  the  distribution  of  peak  deviation  from 
prediction  errors  for  the  design  clocks.  It  will  also  be  necessary  to  incorporate  peak  testing  into 
acceptance  tests. 
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Various  Prediction  Intervals  with  Normal  Distribution  Fit  (R30)  MJD  51666-51816 
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Figure  6.  Prediction  error  for  various  prediction  intervals,  showing  the  distribution  of  errors. 


APPENDIX 

The  key  requirement  of  signal  integrity  refers  to  “the  measure  of  the  trust  that  can  be  placed  in  the 
correctness  of  the  information  supplied  by  the  total  system”  [6].  Integrity  includes  the  ability  of  a  system 
to  provide  timely  and  valid  warnings  to  the  user  (alerts)  when  the  system  must  not  be  used  for  the 
intended  operation  (or  phase  of  flight).”  This  means  the  necessity  of  providing  timely  warning  to  the 
users  when  a  particular  sub-system  is  degraded  or  when  the  system  should  not  be  used.  Loss  of  Integrity 
is  defined  as  the  occurrence  of  an  unsafe  condition,  known  as  hazardous  misleading  information  (HMI), 
without  intimation  to  the  user  for  a  time  longer  than  the  required  time  to  alert.  Hazardous  misleading 
information  is  defined  to  occur  when  the  true  error  resulting  from  the  broadcast  message  exceeds  the 
specified  alert  limit.  The  alert  limits  and  the  times  to  alert  in  Table  1  define  the  boundaries  of  safety 
threats  in  terms  of  error  magnitudes  that  can  be  tolerated  and  the  notification  delays. 

The  Civil  navigation  requirements  listed  in  Table  1  are  categorized  by  phase  of  flight  and  the  necessary 
navigation  attributes  [7].  Signal  Integrity  is  the  foremost  and  encompassing  consideration,  as  safety  is 
paramount  in  aviation  operations.  Time  to  Alert  and  Alert  limit  are  two  of  the  facets  that  constitute 
Integrity.  To  ensure  that  the  position  error  is  acceptable,  an  alert  limit  is  defined  that  represents  the 
largest  position  error  allowable  for  a  safe  operation.  The  position  error  cannot  exceed  this  alert  limit 
without  annunciation  for  a  time  longer  than  the  required  time  to  alert.  This  is  analogous  to  ILS,  in  that  the 
system  can  degrade  so  that  the  error  is  larger  than  the  95th  percentile,  but  within  the  monitor  limit. 

Integrity  attribute  may  be  quantified  in  terms  of  Protection  Levels,  horizontal  and  vertical  thresholds,  and 
associated  time  to  alert  that  the  navigation  system  can  conform  against  a  specified,  low  probability  of 
hazardously  misleading  information  (HMI)  corresponding  to  each  phase  of  flight. 
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Loss  of  Integrity  can  occur  in  two  ways.  It  is  possible  that  under  nominal  conditions,  with  all  equipment 
operating  properly  and  within  specification,  an  error  occurs  that  exceeds  the  alert  limit  for  that  phase  of 
flight.  It  is  also  possible  an  anomaly  within  the  signal-in-space  is  not  detected  within  the  time  to  alarm, 
thus  leading  to  errors  exceeding  the  alert  limit.  Note  that  if  the  error  is  detected  in  time  and  the  operation 
is  aborted,  then  integrity  is  maintained,  but  signal  continuity  is  lost.  However,  if  the  anomalous  element 
is  detected,  properly  identified  and  excluded  within  the  time  to  alert  and  all  the  navigation  requirements 
are  still  met  despite  the  failed  element,  then  the  aviation  operation  can  continue  safely  -  with  maintenance 
of  both  Integrity  and  Continuity. 

Continuity  refers  to  the  likelihood  that  an  operation  that  met  all  navigation  requirements  will  be 
successfully  completed.  Loss  of  Continuity  is  defined  as  the  occurrence  of  an  anomaly  that  causes  loss  of 
safe  navigation  performance  before  the  operation  is  completed. 

Loss  of  Continuity  can  happen  in  two  ways:  a  component  failure  that  is  evident  or  is  detected  by  onboard 
Integrity  monitoring.  If  the  source  of  failure  can  not  be  diagnosed  with  near  certainty,  then  a  general 
alarm  is  issued  and  the  operation  is  aborted.  Here,  continuity  is  sacrificed  to  protect  integrity. 

Service  Availability  refers  to  the  likelihood  that  the  navigation  system  meets  all  requirements  for  an 
intended  operation.  Availability  is,  thus,  contingent  on  meeting  the  accuracy,  integrity,  and  continuity 
requirements,  and  is  important  for  air  traffic  control  purposes.  The  Availability  requirements  are 
expressed  as  a  long-term  probability  that  all  requirements  are  met  over  all  possible  conditions,  including 
varying  GPS  satellite  geometries,  outages,  variations  in  error  magnitudes,  etc. 

Since  Service  availability  expresses  the  probability  that  a  given  operation  can  be  carried  out,  it  is  a  useful 
performance  indicator  for  assessing  navigation  system  architectures  to  support  civil  users.  The  service 
availability  requirements  shown  in  the  enclosed  Table  1  express  the  desired  probabilities  of  being  able  to 
provide  guidance  in  the  various  phases  of  flight. 
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Table  1 .  Civil  navigation  requirements. 


Accuracy 

Integrity 

Continuity  Prob. 

Availability  | 

Phase  of  Flight 

(95%  error) 

Time  to 
Alert 

Alert  Limit 

Prob  (HMI) 

(Loss  of  Navigation) 

Threshold 

Objective 

Oceanic  Enroute 

H:  12.4  nmi 

120  s 

H:  12.4  nmi 

10.'7/hour 

10.'5/hour 

0.99 

0.999  -  0.9999 

Domestic  Enroute 

H:  2.0  nmi 

60s 

H:  2.0  nmi 

10.'7/hour 

10.'5/hour 

0.99 

0.9999 

Terminal  Area 

H:  0.4  nmi 

30  s 

H:  1.0  nmi 

10.'7/hour 

10;5/hour 

0.99 

0.99999 

Non-Precision  App. 

H: 220  m 

10s 

H:  556  m 

10.'7/hour 

10.'5/hour 

0.99 

0.99999 

LNAV/VNAV 

H: 220  m 

8  s 

H:  556  m 

V:  50  m 

10.'7/hour 

5.  x  10."5/hour 

0.99 

0.99999 

APV 

H:16  m 

V:  7.6  m 

6  s 

H:  556  m 

V:  20  m 

5.  x  10.'5/hour 

0.99 

0.99999 

Cat  I  Precision 
Approach 

H:  16  m 

V:  4. 0-7. 6  m 

6  s 

L:  40  m 

V:  10-12  m 

5.  x  10.'5/hour 

0.99 

0.99999 

Cat  II  Precision 
Approach 

H:  6.9  m 

V:  2.0  m 

2  s 

H:  17.3  m 

V:  5.3  m 

4.x  1  O'6/  15  s 

0.99 

0.99999 

Cat  Ilia  Precision 
Approach 

H:  6.0  m 

V:  2.0  m 

1-2  s 

H:  15.5  m 

V:  5.3  m 

L:  2.  x  10’6/30  s 

V:  2.  x  10'6/15  s 

0.99 

0.99999 

Notes  on  Table  1: 

LNAV  Localizer  Performance  with  Vertical  Guidance 

VNAV  Vertical  Navigation 

APV  Approach  with  Vertical  Guidance 

LN  AV/VNAV  essentially  adds  vertical  guidance  to  existing  non  precision  approach 
APV  may  be  seen  as  a  “relaxed”  version  of  Category  I  precision  approach 


447 


38th  Annual  Precise  Time  and  Time  Interval  (PTTI)  Meeting 
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